CVE-2025-4552: Continew Admin Auth Bypass Vulnerability

CVE-2025-4552 Overview

CVE-2025-4552 affects ContiNew Admin versions up to 3.6.0. The vulnerability resides in the /dev-api/system/user/1/password endpoint and allows an unverified password change [CWE-620]. An authenticated attacker with password reset permissions can reset the super administrator account password without supplying or verifying the current password. The flaw is remotely exploitable over the network and has been publicly disclosed. The vendor was contacted prior to disclosure but did not respond.

Critical Impact

Any account holding password-reset privileges can take over the super administrator account, leading to full administrative compromise of the ContiNew Admin instance.

Affected Products

• ContiNew Admin versions up to and including 3.6.0
• Deployments exposing the /dev-api/system/user/{id}/password endpoint
• Environments where the password-reset role is delegated to non-administrative users

Discovery Timeline

• 2025-05-12 - CVE-2025-4552 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-4552

Vulnerability Analysis

The vulnerability is classified under [CWE-620] Unverified Password Change. The endpoint /dev-api/system/user/1/password accepts a new password for the user identified by the URL path parameter but does not require the requester to prove knowledge of the current password. User ID 1 corresponds to the built-in super administrator account in ContiNew Admin.

In a correctly designed flow, a password change initiated by a non-owner account should require either elevated administrative privileges or a re-authentication step. ContiNew Admin instead enforces only a coarse permission check tied to the password-reset role. Any account granted that role can therefore target the super administrator account directly.

Successful exploitation grants the attacker full control of the application, including user management, configuration, and data accessible to the administrator role.

Root Cause

The root cause is missing verification of the original password and missing privilege segregation on the password-change handler. The application treats the password-reset permission as sufficient authorization for any target user, including user ID 1, rather than scoping the permission or requiring the existing credential.

Attack Vector

Exploitation requires network access to the ContiNew Admin API and an account with the password-reset permission. The attacker sends an HTTP request to /dev-api/system/user/1/password containing a new password value. The server overwrites the super administrator credential without further validation. No user interaction is required on the victim side. Technical details are documented in the GitHub Security Guide and the VulDB entry #308299.

Detection Methods for CVE-2025-4552

Indicators of Compromise

• HTTP PUT or POST requests to /dev-api/system/user/1/password originating from non-administrator accounts
• Unexpected successful authentication events for the super administrator account following a password-reset API call
• Audit log entries showing password modification of user ID 1 by a low-privilege role

Detection Strategies

• Inspect web server and application logs for requests targeting /dev-api/system/user/{id}/password where {id} is 1 or other privileged accounts
• Correlate password-change API calls with the role of the calling principal to identify privilege misuse
• Alert on any administrative login that occurs shortly after a password-change request issued by a different user

Monitoring Recommendations

• Enable verbose audit logging on the ContiNew Admin user management subsystem and forward to a centralized SIEM
• Track changes to the super administrator account as a high-priority security event
• Baseline normal password-reset activity per role to surface anomalous spikes or off-hours resets

How to Mitigate CVE-2025-4552

Immediate Actions Required

• Restrict the password-reset role to fully trusted administrative users only and revoke it from any service or low-privilege account
• Block external access to /dev-api/* endpoints using a reverse proxy or web application firewall rule until a patch is applied
• Rotate the super administrator password and review recent password-change audit entries for unauthorized resets

Patch Information

No vendor patch or advisory is currently referenced in the NVD data. The vendor did not respond to the disclosure. Track the VulDB entry #308299 and the ContiNew Admin project for an updated release beyond version 3.6.0.

Workarounds

• Enforce network-level access controls limiting the ContiNew Admin API to trusted management networks or VPN users
• Remove the password-reset permission from all custom roles and require super administrators to perform privileged password operations directly
• Add a reverse-proxy rule denying requests to /dev-api/system/user/1/password and any other privileged user identifiers

# Example nginx rule to block unauthenticated path access to the vulnerable endpoint
location ~* ^/dev-api/system/user/1/password$ {
    deny all;
    return 403;
}